Hackers in Nigeria planting fraud devices to collect pins & ATM card data

ATMs located in highbrow areas in Lagos particularly in Victoria Island and Lekki, might have been compromised following reports of hackers planting fraud devices on some machines so as to get the pin codes and other details of the ATM cards of unsuspecting users and use them to carry out fraudulent activities.

A banker who spoke with Punch said "A number of the ATMs in Victoria Island and Lekki axis have been compromised by hackers. Some of these fraudsters visit those ATMs very late in the night or very early in the morning to fix some fraud devices on them, which are capable of collecting cardholders’ information, including their passwords. They come back later to remove those devices.

The information collected is then used to commit fraud against those customers later. Most of us (banks) are aware of the development and we are very vigilant now. What some of us have done is to get a patrol team of security men to start combing the affected areas and the ATMs from time to time. We will get those guys soon.” the anonymous banker said

Also confirming the report, the Vice-Chairman, Committee of e-Banking Industry Heads, Mr. Dele Adeyinka said banks have recently installed anti-skimming devices on their ATMs so as to checkmate such illicit activities.

“Yes, it is true that hackers are carrying out those activities. It is not only in Victoria Island axis, they are doing it everywhere. But all the banks have complied with the CBN directive on anti-fraud tools. So, it will be difficult for those fraud devices to work.”he said

While some of the cardholders’ information collected by the fraudsters were being used to commit online-related frauds locally, a large number was used to clone ATM cards and used to shop in malls abroad, especially in the US.

As a way to checkmate the activities of these fraudsters, the Central Bank of Nigeria in January this year issued a directive to all Nigerian banks to  prevent payment cards (debit and credit) issued by them from working in fraud-prone countries, including the US, South Africa and China and that they would be liable for any fraudulent transaction carried out in those countries using a customers cloned ATM card. The CBN in another  circular released on February 1, 2015, instructed all Nigerian banks to stop the payment/ATM cards from working in non-Europay, MasterCard and Visa countries. The circular stated that ATM cards that would work in designated countries must be activated only during the period the customer would be spending outside Nigeria. 

The circular which was signed by the Director, Banking and Payment System, CBN, Mr. Dipo Fatokun, reads in part, “The occurrence of card present frauds in non-EMV environments is on the increase, especially when international hybrid cards issued by Nigerian banks are used in non-EMV environments like the USA. It has, therefore, become necessary for the CBN to issue the following directives and that all DMBs should do the following: collate all their card frauds abroad and send to the CBN not later than January 30, 2015; subsequently, all data on card frauds occurring abroad should be rendered on the NIBSS fraud portal; implement anti-fraud solution on their card management systems not later than January 30, 2015; ensure that from February 1, 2015, only customers that expressly indicated the intention of travelling to non-EMV jurisdictions would have their cards default to the magnetic stripe and for the period indicated by the cardholder only.”